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Abstract 

We construct infinite classes of almost bent and almost perfect nonlinear polyno- 
mials, which are affinely inequivalent to any sum of a power function and an affine 
function. 
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1 Introduction 

Vectorial Boolean functions are used in cryptography, more precisely in block ciphers. An 
important condition on these functions is a high resistance to the differential and linear 
crypt analyses, which are the main attacks on block ciphers. The functions with the smallest 
possible differential uniformity (see oppose an optimum resistance to the differential 
attack 3\. They are called almost perfect nonlinear (APN). The functions achieving the 
maximal possible nonlinearity (see ^2 EE!) possess the best resistance to the linear attack 
[21] and they are called almost bent (AB) or maximum nonlinear. 

Up to now, in the study of APN and AB functions the main attention has been payed 
to power mappings and all known constructions of APN and AB functions happen to be 
equivalent to power functions (see for example [SJ 13 HHJ HZ1 HE] ) • Recall that functions 
F and F' are called equivalent if either F' = A x o F o A 2 + A or F' = A 1 o F' 1 o A 2 + A 
(in case F is a permutation) for some affine functions A, A\ and A 2 , where A\ and A 2 are 
permutations. We shall say that two functions F and F' = A\ o F o A 2 + A (with A, A±, A 2 
affine, A\,A 2 being permutations) are extended affine equivalent (EA-equivalent). In this 
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paper we give the first theoretical constructions of APN and AB polynomials which are 
inequivalent to power mappings. In these constructions, we apply the transformation of 
functions given by Car let, Charpin and Zinoviev (see Proposition 3 in ^1]) to the Gold 
APN and AB mappings ^Hl ■ This transformation leads to an equivalence relation of 
functions that we call the Carlet-Charpin-Zinoviev equivalence (CCZ-equivalence). CCZ- 
equivalence corresponds to the affine equivalence of the graphs of functions, i.e. functions 
F and F' are CCZ-equivalent if and only if, for some affine permutation, the image of the 
graph of F is the graph of the function F' . CCZ-equivalence preserves the nonlinearity, 
the differential uniformity of functions and the resistance of a function to the algebraic 
cryptanalysis jEj. It could be expected that CCZ-equivalence coincides in practice with 
the equivalence mentioned above. The present paper aims at proving and illustrating that 
CCZ-equivalence is more general. 

The next section contains all the necessary definitions related to vectorial Boolean 
functions, including EA-equivalence, APN and AB properties. 

In Section 3, we give the definition of CCZ-equivalence, we describe its main properties 
and we show its connections with EA-equivalence. 

We give some results related to a classification of functions CCZ-equivalent to the Gold 
mappings in Section 4. 

Theorems 1, 2 and 4 in Section 5 present constructions of AB and APN polynomials 
which are EA-inequivalent to power functions and Theorem 3 presents an APN function 
EA-inequivalent to all known APN mappings. 

This paper is an extended version of an abstract published in |3]. In particular, Theorem 
4, the proof of Theorem 3 and some properties of CCZ-equivalence are not included in the 
abstract. 

2 Almost perfect nonlinear and almost bent functions 

Let F™ be the m-dimensional vector space over the field F2. Any function F from F™ to 
itself can be uniquely represented as a polynomial on m variables with coefficients in F™, 
whose degree with respect to each coordinate is at most f : 



This representation is called the algebraic normal form of F and its degree d°(F) the 
algebraic degree of the function F. 

Besides, viewed as a function from the field ¥2™ to itself, F has a unique representation as 
a univariate polynomial over ¥2™ of degree smaller than 2 m : 



F(xi, ...,x. 



) = E^dl 2 ?)' 



c(u) G F™. 



uGF™ i=l 



2 m -l 




i=0 
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For any k, < k < 2 m — 1, the number W2(k) of the nonzero coefficients k s G {0, 1} in 
the binary expansion YlT=o ^ s ^s of k is called the 2-weight of k. The algebraic degree of 
F is equal to the maximum 2-weight of the exponents i of the polynomial F(x) such that 
Cj ^ 0, that is d°(F) = maxo<j<„_i )C .^ w 2 {i) (see [II]). 

A function F : F™ — > F™ is linear if and only if F(x) is a linearized polynomial over 
F2m, that is, 

m— 1 

^ CiX 2 \ Ci G ¥ 2 m. 
i=0 

The sum of a linear function and a constant is called an affine function. 

Let F be a function from F™ to itself and Ai, A 2 : F™ — > F™ be affine permutations. 
Then the functions F and /^oFo/^ are called affine equivalent. Affine equivalent functions 
have the same algebraic degree (i.e. the algebraic degree is affine invariant). 

We shall say that the functions F and F' are extended affine equivalent (EA-equivalent) 
if F' = Ax o F o A 2 + A for some affine permutations Ai, A 2 and an affine function A. If 
F is not affine, then F and F' have again the same algebraic degree. 

For a function F : W™ — > F™ and any elements a, b G F™ we denote 

S F (a, b) = \{x G F™ : F(x + a) + F(x) = 6}| 

and 

A F = {5 F (a, b) : a, 6 G F™ a ^ 0}. 

F is called a differentially 5-uniform function if max ae F"",fceF m S F (a,b) < 5, where F™* = 
F™ \ {0}. For any a, b G F™, the number S F (a,b) is even since if Xo is a solution of the 
equation F(x + a) + F(x) = 6 then xq + a is a solution too. Hence, 5 > 2. Differentially 
2-uniform mappings are called almost perfect nonlinear. 
For any function F : F™ — > F™, the values 

\ F (a,b)= Y^(-lt F{x)+a - x , a, 6 G F™, 

do not depend on a particular choice of the inner product " ■ " in F™. If we identify F™ 
with ¥ 2 m then we can take x-y — tr(xy), where tr(x) = x + x 2 + x 4 + . . . + x 2 ™ is the trace 
function from ¥ 2 m into F2. Later we shall also need for a divisor n of m the relative trace 
"m/n (^J — x + # + s +... + X and we denote tr n (x) = x + x +x + ... + X 

The set A F = {X F (a, b) : a, b G F™, 6 7^ 0} is called the Walsh spectrum of F and the value 

NC(F) = 2 m - 1 max |A F (a,6)| 

2 aGF^.&GFJ 1 * 

the nonlinearity of the function F. The nonlinearity of any function F satisfies the in- 
equality 

J\fC(F) < T 1 - 1 - 2^ 
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(^3 EH!) and in case of equality F is called almost bent or maximum nonlinear. For any 
AB function F, the Walsh spectrum equals {0, ±2^"} as it is proven in [T3*] . 

For EA-equivalent functions F and F', we have A^ = Ap>, Ap = Ap> and if F is a 
permutation then A^ = Ap-i, Ap = Ap-i (see Therefore, if F is APN (resp. AB) 

and F' is EA-equivalent to either F or F~ l (if F is a permutation), then F' is also APN 
(resp. AB). 

Table 1 (resp. Table 2) gives all known values of exponents d (up to EA-equivalence and 
up to taking the inverse when a function is a permutation) such that the power function 
x d is APN (resp. AB). 

Table 1 



Known APN power functions x on F2™. 





Exponents d 


Conditions 


102(d) 


Proven in 


Gold functions 


2 l + 1 


gcd(i, m) = 1 


2 


19, 26 


Kasami functions 


2 2i - 2* + 1 


gcd(i, to) = 1 


i + 1 


21 22 


Welch function 


2* + 3 


TO = 2t + 1 


3 


ca 


Mho function 


2* + 2* - 1, t even 
2* + 2^ - 1, t odd 


TO = 2t + 1 


(t + 2)/2 
t+1 


ESI 


Inverse function 


2 « _! 


TO = 2t + 1 


m — 1 


2 26 


Dobbertin function 


2 4i + 2 3i + 2 2» + 2' 1 - 1 


TO = 5z 


i + 3 


CHI 



Table 2 

Known AB power functions x d on F2™, m odd. 





Exponents d 


Conditions 


Proven in 


Gold functions 


2 l + 1 


gcd(i, m) = 1 


19 26 


Kasami functions 


2 21 - 2 l + 1 


gcd(i, to) = 1 


22 


Welch function 


2* +3 


TO = 2t + 1 


mm 


Niho function 


2* + 25 - 1, t even 
2* + 2^ - 1, f odd 


to = 2t + 1 


20 



Every AB function is APN [13 . The converse is not true since AB functions exist only 
when m is odd while APN functions exist for m even too. Besides, in the m odd case, the 
Dobbertin APN function is not AB as proven in j7j. Also the inverse APN function is not 
AB since it has the algebraic degree m — 1 while the algebraic degree of any AB function 
is not greater than [m + l)/2 (see [TT]). When m is even, the inverse function x 2m ~ 2 is a 
differentially 4-uniform permutation j2Ej and has the best known nonlinearity [2B], that is 
2 m_1 — 2~ (see [UEI])- When m = 2 [mod 4] and gcd(i,m) = 2, the functions x 2 ' +1 and 
x 2 1-21+1 also have the best known nonlinearity 122] and when gcd(i, m) = s and m/s 
is odd, these functions have three valued Walsh spectrum {0, ±2 I2 2 Ji } ( '30j ) . 

3 Carlet-Charpin-Zinoviev equivalence of functions 

For a function F from to itself, we denote by Gf the graph of the function F: 

G F = {(x,F(x)) : x e¥™} C¥i m . 
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The property of stability of APN and AB functions given in Proposition 3 of pi] leads to 
the definition of the following equivalence relation of functions. 

Definition 1 (CCZ-equivalence) We say that functions F, F' : F' 2 n — ► F™ are Carlet- 
Charpin-Zinoviev equivalent if there exists a linear (affine) permutation £ : F| m — > F| m 
such that C(Gf) = Gf 1 ■ 

We shall consider only the case of linear functions, but all proofs for the statements related 
to the CCZ-equivalence can be easily extended for the case of affine functions too. 

A linear function £ : F| m — > F^™ can be considered as a pair of linear functions 
L U L 2 : ¥ 2 2 m -> F™ such that £(x,y) = {Lx{x,y),L 2 {x,y)) for all x, y E F™. Then for a 
function F : F™ — > F™ we have £(x,F(x)) = (F 1 (x) 1 F 2 (x)), where 

F 1 (x)=L l (x,F{x)) 1 (1) 



F 2 (x)=L 2 (x,F(x)). (2) 

Hence, the set £{Gp) = {(Fi(x) , F 2 (x)) : x E F™} is the graph of a function F' if and 
only if the function F\ is a permutation. If £ and Fx are permutations then £(Gp) = Gpr, 
where F' = F 2 o F^ 1 , and the functions F and F' are CCZ-equivalent. 

In the proposition below, we give a slightly different approach to the CCZ-equivalence, 
that we shall use in the constructions of APN polynomials which will be EA-inequivalent 
to power functions. Recall that a set G C F^ 7 ™ is transversal to a subgroup V of F| m if 
\G D (u + V)\= 1 for any u E F| m . 

Proposition 1 Let F : F™ — > F™ and G C F^" 1 . T/ien i/ie sei G zs the graph of a function 
CCZ-equivalent to F if and only if there exists a linear permutation £ : ¥ 2 m — > F^" 1 such 
that G = £(G F ) and G F is transversal to V = ^(V), where V = {(0,x) : x E F™}. 

Proof. The condition that there exists a linear permutation £ : F| m — > W^ 171 such that 
G = £{Gp) is clearly necessary. Let us denote U = {(x, 0) : x E F™}, V = {(0,x) : x E 
F™}, £~ 1 (U) = U' and = V. Then G is the graph of a function if and only if 

|G n (u + V)\ = 1 for any u E U; that is, if and only if |£ _1 (G) n (u' + V')\ = 1 for any 
«' G Z7'. Hence, G is the graph of a function CCZ-equivalent to F if and only if Gf is 
transversal to V'. □ 

Let F be an arbitrary function on F™ and V' be an arbitrary subgroup of F^" 1 . If we 
denote 

H a = {F(x + a)+ F(x) : x E F™}, a E F™*, 

A F = {(a,F(x + a) + F(x)) : a e F; m ,a; G F 2 ™}, 

then = |J agF . (a, if a ). It is easy to note that ApOV' — if and only if Gi? is transversal 
to V. We shall see that, to construct a function CCZ-equivalent but EA-inequivalent to 
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the function F, it is necessary that the subgroup V in Proposition ^ is different from V 
and as soon as we have a subroup V such that Gf is transversal to V we can find a linear 
permutation £ that V = £ _1 (V). However, even if we have such a subgroup it is difficult 
to determine whether the resulting function is EA-inequivalent to F. 

The property of stability of APN and AB mappings (see ^1]) can be easily generalized 
to all functions (not necessarily APN or AB) as follows: 

Proposition 2 Let F, F' : F™ — > F™ be CCZ-equivalent functions. Then A F = A F > and 
A F = Ap>- In particular, F is an APN (resp. AB) function if and only if F' is APN (resp. 
AB). 

Proof. If F,F' : F™ — > F™ are CCZ-equivalent, then F' = F2 o FF for a certain linear 
permutation C = (Li,L 2 ), where Fi,F 2 are defined by (JTJ) and (j2J). For any (a, b) e ¥ 2 m 
we have 

xeF™ xgf^ 
= \ F ,(C- U (a,b)), 



where is the adjoint operator of C~ l (i.e. x-C~ 1 {y) = £ -1 *(:c)-y, for any (x, y) G F| m ; 
if "•" is the usual inner product, then C~ l * is the linear permutation whose matrix is trans- 
posed of that of Hence, = A F >. 

The proof that A^ = A F i for arbitrary functions F,F' is completely the same as in the 
case when one of the functions F, F' is APN (see [II]). □ 

Remark 1 Obviously, CCZ-equi valence can be defined for functions between any two 
groups H\ and H 2 . For a function F : Hi — > H 2 we can consider the set of the values 
5 F (a,b) = \{x e Hi : F(x + a)-F(x) = b}\, a e Hi\{0}, b e H 2 , and if the groups Hi and 
H 2 are Abelian, then the discrete Fourier transform of F can also be defined. In this more 
general case CCZ-equivalent functions again have the same differential and linear proper- 
ties. One can find results related to nonlinear functions on Abelian groups in [T21 125] . O 

Since CCZ-equivalent functions have the same differential uniformity and the same 
nonlinearity, the resistance of a function to linear and differential attacks is CCZ-invariant. 
CCZ-equivalent functions have also the same weakness/strength with respect to algebraic 
attacks. Indeed, let functions F, F' : F^ -> FJT be CCZ-equivalent. Then F' = F 2 o Ff 1 , 
where Fi,F 2 are defined by and (J2J) for a certain linear permutation C = (Li,L 2 ). If 
there exists a nonzero function ip : F^™ — ■> F 2 of low degree such that 

ip(x,F(x)) = 0, Vx G F™, (3) 
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then if) could be used in an algebraic attack ^3] . The function if) o C 1 has the same degree 
as if) and Relation (J3J is equivalent to 



by replacing x by Ff (x). Hence, if) o C" 1 could be used in an algebraic attack on F', 
and vice versa. Therefore, the resistance of a function to algebraic attacks is also CCZ- 
invariant. 

Since any permutation is CCZ-equivalent to its inverse then obviously the algebraic degree 
of a function is not CCZ-invariant (while it is EA- invariant as noted above). For example, 
if F : F™ -> F™ is a Gold AB function then d°(F) = 2 and d°(F~ 1 ) = a±i as proven in [2E]. 

EA-equivalent functions are CCZ-equivalent and if a function F is a permutation then 
F is CCZ-equivalent to F -1 [TT]. More precisely: 

Proposition 3 Let F, F' : F™ — > F™. T/ie function F' is EA-equivalent to the function 
F or to the inverse of F (if it exists) if and only if there exists a linear permutation 
C = (Li,L 2 ) on F| m such that C(Gp) = Gp> o,nd the function L\ depends only on one 
variable, i.e. L\(x,y) — L(x) or Li(x,y) = L(y). 

Proof. Let C(Gf) = Gf> for some linear permutation C = (Li,L 2 ) : Ff" 1 — > F 2 m and 
Lt(x,y) = L(y), L 2 (x,y) = Rt(x) + R 2 (y), where L, R u R 2 : F™ -> F™ are linear. Then 

Fi(ar) = F(x)) = L o F(x), 

F 2 {x) = L 2 (x, F(x)) = Rt(x) + R 2 o F(x). 

The function F\ is a permutation, since C(Gp) is the graph of a function. Therefore, L 
and F have to be permutations. On the other hand, the system 



has only (0, 0) solution, since C = (Fx, L 2 ) is a permutation. But L is also a permutation. 
Therefore, the linear function Fi has to be a permutation too. 
We have 

F'(x) = F 2 o Ff x (x) = Fi o F" 1 o L _1 (a;) + fi 2 ofoF 1 o £ -1 (z) 
= Fi o F" 1 o L _1 (x) + F 2 o L _1 (x). 

Thus, F' is EA-equivalent to F _1 . 

The proof that F' is EA-equivalent to F, when L\{x,y) = L{x), is similar. 

Conversely, let F' = FioFoF 2 +F or F' = R\oF^ 1 oR 2 +R for some linear permutations 
Fi, F 2 and for some linear function F. Then take C(x, y) = (F 2 ~ 1 (x), Ri(y) + R o F 2 ~ 1 (a;)) 



^o£- 1 (F 1 (x),F 2 (x)) =0, VxeF: 



<m 



which implies 



ipoC- 1 (x,F'(x)) = 0, MxeW 2 
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in the first case and in the second case take C(x, y) = (R 2 1 (y), R ° R 2 1 (y) + Ri(x))- Ob- 
viously, all conditions are satisfied. □ 

Remark 2 Proposition El shows that, for a function F : F™ — > F™, if C = (L 1 ,L 2 ) 
and £' = (Li,L' 2 ) are linear permutations on ¥ 2 m such that the function Li(x, F(x)) 
is a permutation, then the functions defined by the graphs C(Gp) and C'(Gp) are EA- 
equivalent. Indeed, we have (£'o£ _1 )o£(G f ) = C'(Gf) and, denoting (£'o£ _1 ) = (Si, S2), 
we have S\(x,y) = x. This last equality can be easily checked by considering the linear 
functions C, £' and C~ l as (2m) x (2m) matrices 

£ _ f R\ R2 \ £/ _ / -Rl -R2 \ £-1 / ^1 ^2 



We have 

i?x i? 2 \ / Ai A 2 \ / iMi + i? 2 A 3 R X A 2 + i? 2 A 4 \ / I 
7\ T 2 J X ^ A 3 A 4 J {t.A.+T.A, T x A 2 + T 2 A 4 J [o I 

where / is the identity matrix and is the 0-matrix of order m, and this implies 

R x R 2 \ ( A x A 2 \ _( I 
T{ V 2 J X \A 3 A, J I T^ + T^A, TIA 2 + T>A 4 



O 



Proposition 01 shows that if we want to construct functions F 1 which are CCZ-equivalent 
to a function F and EA-inequivalent to both F and F _1 (if F~ x exists), then we have to 
use a linear function Li(x,y) depending on both variables. However, this condition is not 
sufficient as the following example shows. 

Example 1 Let m = 2n + 1 and s = n [mod 2] . Then the linear function 

n— s 

C(x, y) — (x + tr(x) + y 22j+s ; y _|_ tr(x)) 

3=0 

is a permutation on ¥ 2m since the kernel of C is {(0, 0)} (this can be checked by considering 
the cases tr(x) = and tr(x) = 1). For the Gold AB function x 3 the function 



F x (x) =x + tr(x) + ^(x 3 ) 2 J+s 
3=0 

is a permutation on F 2 m. Indeed, denoting L(y) = Y^jZo y 22j+a we have L(y+y 2 ) = y+tr(y) 
and L((y + l) 3 ) = L(y 3 ) + y + tr(y) + 1 since L(l) = 1. Thus F x (x) = L((x + l) 3 ) + 1 and 
Fx is a permutation if L is bijective. The equation z = L(y) implies z + z 2 = y + tr(y) 
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and tr(z) = tr(y). Therefore, L is a permutation and L 1 (x) = x + x 2 + tr(x), F 1 (x) = 
[L^{x + + 1. Finally, we get 

F\x) = F 2 o F{\x) = {[L-\x + l)]s + l) 3 + tr([L-\x + l)]s + 1) 

= L-\x + 1) + [L-\x + l)]l + [L- X (x + l)]i + tr([L-\x + 1)]5) 
= L-^ar + ^+L-^fL-^z + l)]^. 

Thus, both functions L\ and L 2 depend on two variables, but the function F' is EA- 
equivalent to the inverse of x 3 . 

This example can be generalized for any Gold AB function by replacing L~ l (x) = x + x 2 ' + 
tr(x) and x 3 by x 2 ' +1 . O 

If we want to classify all functions CCZ-equivalent to a given one F, then we should char- 
acterize all permutations of the form L o F + L', where L, V are linear. Indeed, we need to 
know which linear mapping L\ : F^" 1 — > W™ is such that the function Fi(x) = Lx(x, F(x)) 
is a permutation. Clearly, L\ can be written uniquely in the form Li(x, y) = L(y) + L'(x). 
If Fx is a permutation then there exists a linear function L 2 (x,y) such that the linear 
function (L±, L 2 )(x,y) is a permutation too. Indeed, Li(x, F(x)) being a permutation, Li 
is onto and the kernel of L\ has then dimension m. We can take for L 2 any linear permuta- 
tion between Ker(Li) and F™, extended to ¥ 2 m by L 2 (x + y) = L 2 (x) for all x G Ker(Li), 
y E E, where E is an m-dimensional subspace of _F| m such that E © Ker(Li) = ¥ 2rn . Con- 
versely, any linear function L 2 such that (Li,L 2 ) is a permutation has this form. Indeed, 
L 2 being onto, it has also an m-dimensional kernel, and (Li,L 2 ) being one to one, the 
kernels of L\ and L 2 have trivial intersection. This proves that Ker(Li) © Ker(L 2 ) = ¥ 2 m 
and that we can take E = Ker(L 2 ). 

The following proposition gives a sufficient condition for a function to be EA-inequivalent 
to power functions. 

Proposition 4 Let F be a function from F 2 ™ to itself. If there exists an element c G F^m 
such that d°(tr(cF)) ^ {0, l,d°(F)}, then F is EA-inequivalent to power functions. 

Proof. It is proven in jH] that for any power function x d and for any c G F2m, either the 
function tr(cx d ) completely vanishes or it has exactly the algebraic degree w 2 (d). Thus, 
for any function F which is affine equivalent to a power function, we have d°(tr(cF)) G 
{0, d°(F)}, c G ¥ 2m . Therefore, if F is EA-equivalent to a power function then d°(tr(cF)) G 
{0, l,d°(F)}, for every c G F* m . □ 

4 CCZ-equivalence and the Gold functions 

In the propositions below we give a characterization of permutations L o F + V when F is 
a Gold function. This characterization is not complete but it is useful for constructions of 
new APN and AB polynomials. 
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Proposition 5 Let F : F 2 m — > F 2 ™, ; F(x) = L(x 2 ' +1 ) + L'(x), where L,L' are linear and 
gcd(m, i) — 1. T/ien F is a permutation if and only if, for every u 7^ in ¥2™ and every 
v such that tr(v) = tr(l), the condition L{vF +l v) 7^ L'(u) holds. 

Proof. For any u £ F 2m we have 

F(x) + F(x + u)= L(x T+1 ) + L\x) + L((x + uf +1 ) + L'(x + u) 

= L (ux 21 + u 2 'x + n 2l+1 ) + L\u) = L (u 2 ' +l Ux/uf +x/u+l))+ L\u). 

When x ranges over F 2 ™ then (x/u) 2 ' +x/u + l ranges over {v £ F 2 m : tr(v) = tr(l)}, since 
gcd(m, i) = 1. Hence, F is injective (i.e. is a permutation) if and only if L(u T+1 v) 7^ L'(u) 
for every w 7^ and every v such that tr(f) = tr(l). □ 

Remark 3 If m is even, then, up to affine equivalence and without loss of generality, we 
can consider only functions of the type L(x 2 ' +1 ) +x. Indeed, if F(x) = L(x 2l+1 ) + L'(x) is 
a permutation on F 2 m and m is even, then it follows from Proposition El that L' must be a 
permutation (take v = 0). Then the function F'(x) = L'^ 1 o F(x) = L /_1 o L(x 2l+1 ) + x is 
a permutation if and only if F is a permutation. Moreover if a function L 2 : F 2m — > F 2 m 
is such that the function (L(y) + L'(x), L 2 (x, y)) is a permutation on F 2m , then obviously 
(L /_1 oL(y) +x, L 2 (x, y)) is a permutation too; note also that (L(y)+x, y) is a permutation 
for any linear function L. Thus the function x T+1 is CCZ-equivalent to the functions 
F 2 oF'~ 1 and F 2 oF _1 , where F 2 (x) = L 2 (x, x 2 * +1 ). We have F 2 o F'" 1 (x) = F 2 of" 1 oL'(x). 
Therefore, F 2 o F'" 1 and F 2 o are affine equivalent. O 

Proposition 6 Let F : F 2 m — > F 2 m ; F(x) = L(x 2l+1 ) + x, where L is linear, m even and 
gcd(m, i) = 1. Let L* be the adjoint operator of L. Then F is a permutation if and only 
if, for every v £ F 2 m such that L*{y) 7^ ; there exists u £ F 2 m such that L*{y) = u 2t+1 and 
t r m/2^) 7^ 0, where tr m / 2 is the trace function from F 2 ™ to F 2 2. 

Proof. The function F is a permutation if and only if, for every v 7^ 0, the Boolean function 
tr(v(L(x 2t+1 ) + x)) is balanced (see e.g. [T0| ) . Let L* be the adjoint operator of L, then 
we have 

tr{v{L{x T+1 ) + x)) = tr{L*{v)x T+l + vx). 

If L*(v) = 0, then the function tr(v(L(x 2l+1 ) +x)) is balanced. If L*(v) 7^ 0, the quadratic 
function tr{L*{v)x 2l+l + vx) has associated symplectic form : 

(p(x, y) = tr(L*(v)x 2l y + L*(v)xy 2 ') = tr((L*(v)x 2 ' + (L*(v)x) 2m ")y) , 

which has kernel : 

£ = {x6F 2 ™: L*(v)x 2 ' + (L*(v)x) 2m " = 0} = 
= {x £ F 2m : L*(vfx 22 ' + L*(v)x = 0} = {0} U {x £ F 2 ™ : L^wf-V 2 *- 1 = 1}. 
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A quadratic function is balanced if and only if its restriction to the kernel of its associated 
symplectic form is not constant [HI Ej- The restriction of tr(L*(v )x 2 ' +1 ) to £ is null. 
Indeed, L*(v) 2 '~ 1 x 2 -1 = 1 implies that the order of L*(v)x 2 ' +1 divides 2* — 1 and since 
gcd(i,m) = 1 then L*(v)x 2 ' +1 £ F 2 and the trace function is null on F 2 , since m is even. 
Hence, the function L(x 2 * +1 ) + x is a permutation if and only if every v such that L*(v) ^ 
lies outside the dual of {0} U {x £ F 2 ™ : L*(t>) 2l_1 x 2 = 1}. Equivalently, the function 
L(x 21+1 ) + x is a permutation if and only if, for every v such that L*(v) ^ the following 
two conditions hold: 

1) L*{v) 2l ~ l belongs to {x 2 1-1 : x £ F 2 m} (otherwise, £ would be trivial), say L*(v ) 2I_1 = 
u 2 l ~ l , i.e. L*(v) = u 2 ' +1 (since the mapping y — > y 2 ' 1 is a permutation); in this case £ = 
{0} U {x £ F 2 ™ : (mx) 22 '- 1 = 1} = ±{y £ F 2m : y 2 ^ = y} = ±F 2 ;, where j = gcd(2*, m) = 2, 
hence £ = -F 4 : 

2) t> lies outside the dual of £ , that is, L{vx) ^ for some x E £ . 
For every z £ F 2 m and every y £ F 2 2 we have 

I z z 

tr(z-y) = tr 2 {tr m/2 {-y)) = tr 2 {ytr m/2 {-)). 
u u u 

Hence, the function L(x 2 ' +1 ) +x is a permutation if and only if every v such that L*(v) ^ 
satisfies L*(v) = u 2 ' +1 for some u and tr m / 2 {-) ^ 0. □ 



5 New cases of AB and APN functions 

The next theorems show that CCZ-equivalent functions are not necessarily EA-equivalent 
(including the equivalence to the inverse). They lead to infinite classes of almost bent and 
almost perfect nonlinear polynomials, which are EA-inequivalent to power functions. 

For the function F' : F 2 m — > F 2 m, F(x) = x 2 ' +l , gcd(m, i) = 1, and for any a £ F 2 m the 

set 



H a = {F(x + a) + F(x) : x £ F 2 ™} 



{x £ F 2 m : tr(a~ (2l+1) x) = 1} if m is odd 
{x £ F 2 m : tr(a~^ 2l+1 ^x) = 0} if m is even 



is a linear hyperplane when m is even and a complement of a linear hyperplane when m is 

odd (see [1] or Proposition (HJ. 

We can use Proposition [T] For any a £ F 2m the set 

v , = \ (0, ¥ 2m \H a ) U (a, ¥ 2m \H a ) if m is odd 
[ (0, H a ) U (a, ¥ 2 m\H a ) if m is even 

is a subgroup of F 2m such that Gp is transversal to V since Ap D V = 0. 

Theorem 1 TTie function F' : F 2 m — > F 2 m ; m > 3 odd, 

F'(a;) = x 2l+1 + (x 2 ' + x)tr(a; 2I+1 + x), gcd(m, i) = 1, 

zs an AB function which is EA-inequivalent to any power function. 
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Proof. It is easy (but lengthy) to prove that for a G ¥ 2m the linear mapping 

C{x, y) = (x + a tr(a' l x) + a tr(a~ {2 ' +1) y),y + a 2 ' +1 tr(a~ {2l+1) y) + a 2 ' +l tr(a~ l x)) 
is an involution. We have 



(a,y + a 2 ' +1 ) if y 6 H a 

(0,y) if ye¥ 2m \H a ' 



Since tr(a~^ l+l ' a? +l ) = 1, then a 2 ' +1 E H a . The set H a is a complement of a linear 
hyperplane, hence the sum of any two elements from H a belongs to ¥ 2 m\H a . Therefore, 
C^(V) = C(V) = V and by Proposition [T] the function F is CCZ-equivalent to F 2 o Ff , 
where 

Fi(x) = Li(x, F(x)) = x + a tr(x/a) + a tr((x/a) 2 

F 2 (x) = L 2 (x, F(x)) = x 2 ' +1 + a 2 ' +1 tr((x/af +1 ) + a 2l+1 tr(x/a). 

The function Fx is an involution (this proves again that it is bijective): 

F\ o Fiix) = x + a tr{x/a) + a tr((x/a) 2 +1 ) + a tr(a~ 1 (x + a tr{x/a) 

+ a tr((x/a) 2 ' +1 ))) + a tr(a^ r+1 \x + a tr(x/a) + a tr((x/a) 2 ' +1 )) 2 ' +1 ) 
= x + 3a tr(x/a) + 2a tr((x/ a) T+1 ) + a tr(a~ {2 ' +1 \x 2 ' +1 + (ax 2 ' + a 2 'x 
+ a T+l )(tr(x/a) + tr((x/ 'a) 2 ' +1 )))) = x + a tr(x/a) + a tr((x/a) 2 ' +1 ) 
+ a tr((x/a) 2 ' + (x/a) + l)(tr(x/a) + tr((x/a) 2l+1 )) = x, 

since 

(x + a tr(x/a) + a tr((x/a) 2 ' +1 )) 2 ' +1 = x 2 ' +1 + (ax 2 ' + a 2 'x + a 2 ' +1 )(tr(x/a) + tr((x/ a) 2 ' +l )) 

+2a 2 ' +1 tr(x/a)tr((x/a) 2 ' +1 ) = x 2 ' +1 + (ax 2 * + a 2 ' x + a 2 ' +l )(tr(x/ a) + tr((x/a) 2 ' +1 )). 
Therefore, 

F 2 o F^(x) = (x + a tr(x/a) + a tr((x/ 1 a) 2 ' +1 )) 2 ' +1 + a 2l+1 tr(a~ {T+1) (x + a tr(x/a) 
+ a tr((x/a) 2l+l )) 2%+l ) + a 2 ' +l tr(a' 1 (x + a tr(x/a) + a tr((x/ a) 2l+l ))) 
= x 2 ' +1 + (ax 2 ' + a 2 'x + a 2 ' +1 )(tr(x/a) + tr((x/af +l )) + a T+1 tr((x/ a) 2 ' 
+ (x/a) + l)(tr(x/a) + tr((x/af +1 )) + 2a 2l+ Hr(x/a) + 2a 2t+1 tr((x/a) 2 ' +1 ) 
= a T+1 [(x/a) 2 ' +1 + ((x/af + (x/a))tr((x/a) + (x/af +1 )} = a 2l+1 F'(x/a), 

where F'(x) = x 2 ' +1 + (x 2 ' + x)tr(x + x 2 ' +1 ). By Proposition El the function F' is AB. 
It is not difficult to see that the algebraic degree of F' is 3 for m > 3. On the other 
hand tr(F'(x)) = tr(x 2 ' +1 ) and d°(tr(F'(x))) = 2. It follows from Proposition 0] that F' is 
EA-inequivalent to any power function. □ 
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Remark 4 It was conjectured in ^T] that any AB function is EA-equivalent to a permu- 
tation. The AB function from Theorem 1 serves as a counterexample for this conjecture. It 
was checked by the help of a computer, that for no linear function L on F 2 s the sum F' + L 
is a permutation for the AB function F'(x) = x 2l+l + (x 2 * + x)tr(x T+1 + x), gcd(5, i) — 1. 
Thus, F' is EA-inequivalent to any permutation but it is CCZ-equivalent to the permuta- 
tion x 2 . For m even the existence of APN permutations on ¥ 2 ™ is an open problem. It 
is shown by Nyberg that there exist no quadratic APN permutations when m is even |2Zj . 
But as we have seen the nonexistence of permutations EA-equivalent to the Gold functions 
does not mean yet that there exist no permutations CCZ-equivalent to them. O 

Theorem 2 The function F' : ¥2™ — > ¥2™ , m > 4 even, 

F\x) = x 2 ' +1 + (x 2 ' + x + l)tr(x 2t+1 ), gcd(m, i) = 1, 

is an APN function which is EA-inequivalent to any power function. 

Proof. For a 6 FJjm, the linear mapping 

£0, V) = (L u L 2 )(x, y) = (x + a tr(a' (2l+1) y),y) 

is an involution and, obviously, C(V) = V. Thus, by Proposition [T] the function F is 
CCZ-equivalent to F 2 o F{~ , where 

Fx(x) = L x (x, F(x)) =x + a tr((x/a) 2 ' +1 ), 
F 2 (x) = L 2 (x,F{x)) =x 2%+l . 

The function F\ is an involution: 

F 1 o Fi(x) = x + a tr((x/af l+1 ) + a tr(a- {2 ' +1 \x T+1 + ax T tr{(x/a) 2 ' +1 ) 
+ a 2l x tr((x/a) 2 ' +1 ) + a 2 ' +1 tr((x/af +1 ))) 

= x + 2a tr((x/a) 2 ' +1 ) + a tr((x/a) 2 ' + (x/a) + l)tr((x/a) 2 ' +1 ) = x. 

We have 

F 2 o Ff l (x) = (x + a tr((x/af +1 )f +1 = x 2 * +1 + ax T tr((x/af +1 ) 
+ a 2 'x tr((x/af +1 ) + a 2 ' +l tr((x/af +1 ) 
= a 2 ' +1 [(x/af +1 + ((x/af + (x/a) + l)tr((x/af +1 )}. 

The function F 2 o F{ 1 is EA-equivalent to the function 

F'(x) = x T+l + (x 2% + x + l)tr(x 2 ' +1 ). 

Hence, F' is CCZ-equivalent to F and it is APN by Proposition El The algebraic degree 
of F' is 3 and d°(tr(F')) = 2 as tr(F'(x)) = tr(x 2l+1 ). Therefore, F' is EA-inequivalent to 
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power functions by Proposition EJ 



□ 



Note that the proofs of Theorems [Hand El do not depend on the condition gcd(z, m) = 1. 
When gcd(i,m) = s then the functions F' have the same differential and linear properties 
as x 2l+1 and, therefore, if m/s is odd they can be considered as the first polynomials with 
three valued Walsh spectrum {0, ±2 ZS 2^}, which are EA-inequivalent to power functions. 

Theorem 3 The function F' : F2^ — > ^2 m , m divisible by 6, 

F\x) = [x + tr m/3 (x 2 ^ + x 4 ^) + tr(x)tr m/3 (x 2l+1 + x ^+^))f+\ 
with gcd(m, i) = 1, is an APN function. 

Proof. The linear function C : F 2 .™ — > F| m , 

C(x,y) = (L 1 ,L 2 )(x,y) = (x + tr m/3 (y 2 + y 4 ),y) 

is a permutation since it has the kernel {(0, 0)}. For m divisible by 6, the function 

F x (x) = Li(x, F{x)) =x + tr m/3 (x 2 ^ +l) + x 4(2 * +1) ) 

is a permutation. Indeed, by PropositionEJthe function F\ is a permutation if for every v G 
¥ 2 m such that tr(v) = and every u G F^m the condition tr m / 3 ({u 21+1 v) 2 + (-u 2l+1 t>) 4 ) ^ u 
holds. Obviously, for any u F 2 3 the condition is satisfied and when u G F^ the condition 
tr m / 3 {{v? +l v) 2 + (w 2l+1 t>) 4 ) 7^ it is equivalent to {u 2%+l tr m / 3 {v)) 2 + (u 2t+l tr m / 3 (v)) 4 ^ u. 
Therefore, F\ is a permutation if, for every u,w G F^, tr 3 (w) = the condition (u 2l+1 w) 2 + 
[u 2l+l w) 4 7^ w is satisfied and that was easily checked by a computer. 

We show below that Ff 1 = Fi o Fi o Fi o Fi o Fi. 
We denote 

T(x)=tr m/3 (x 2I+1 ), 

then 

F x (x) = x + T(x) 2 + T(x) 4 . 
Since every element of F 8 is equal to its 8 power and the function tr m / 3 (x) is on F 8 , then 

T o Fl (x) = tr m/3 [(x + tr m/3 {x 2 ^ + x 4 ^)f +1 ] 
= tr m/3 [(x + tr m/3 (x 2 ^ + x 4 ^)){x 2 ' + tr m/3 {x 2W ^ 
+ x 2I+2 ( 2!+1 )))] = tr m/3 [x 2l+1 + x tr m/3 (x 2l+1 ^ + x 2 ^ 2 ^) 
+ x 2l tr m/3 (x 2 ^ + x 4 ^)] = tr m/3 (x)tr m/3 (x 2S+1 ^ + x 2 ° +2 ^) 
+ tr m/3 (x 2S )tr m/3 (x 2 ^ + x 4 ^) + tr m/3 (x 2l+1 ), 
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where s = i mod 3. 
Therefore, 

F 1 o F 1 (x) = F 1 (x) + [T o F 1 (x))] 2 + [T o F 1 (x))] 4 
= x + 2tr m/3 (x 2 ^ + x 4 ^) + tr m/3 (x 2 )tr m/3 (x 2S+2 ^ 
+ x 2 ^) +tr m/3 (x 2S+1 )tr m/3 (x^ +x 2l+1 ) 

+ tr m/3 {x 4 )tr m/3 {x 2 ^ +x 2S+1 ^) +tr m/ 3(x 2S+2 )tr m/3 (a; 2l+1 +a; 2 ( 2l+1 )) 

Considering separately the cases s = 1 and s = 2 we get 

Fi oF 1 (x)=x + tr m/3 (x + x 2 + x 4 )tr m/3 (x 2l+1 + x 2S{T+1) ) 

= x + tr(x)tr m/3 (x T+1 + x 2S{T+i y) =x + (T(x) + T(x) 2S )tr(x). 

Like this we get 

F 1 o F l o F 1 o F 1 o Fi(x) = x + T(x) 2 + T(x) 4 + tr(x)(T(x) + T(x) 22s ), 
F 1 o F 1 o Fi o Fx o F 1 o Fi(x) = x. 

Thus, 

F'(x) = F 2 o F-\x) = [x + T(x) 2 + T(xf + tr(x)(T(x) + T(x) 22s )] 2<+1 = x 2 ' +1 + T(x) 2S+1 
+ tr(x 2 ' +1 )T(x) 22s + tr(x)(T(x) + T(x) 4 ) + xtr(x)(T(x) + T(x) 2S ) 
+ x 2 'tr(x)(T(x) + T(xf s ) + x(T(x) + T(xf s ) + x 2 '(T(x) 2 + T(x) 4 ), 

where F 2 (x) = L 2 (x,F(x)) = x T+1 . 

The function F' has the algebraic degree 4, this can be shown by lengthy but uncom- 
plicated calculations. Hence, F' is EA-inequivalent to other known APN functions since 
for m divisible by 6 we have no known APN functions of algebraic degree 4. □ 

Let F : F 2 m — > F 2 m, F(x) = x 2 ' +1 with gcd(m, i) — 1, m odd and n a divisor of m. 
Then A F n V" = for the subgroup 

V = {(6,x) : b e ¥ 2 n,xe ¥ 2 m,tr m/n (x) = 0}, 

since if (b,x) G V then tr(6^ 2!+1 );r) = tr n (5~( 2 ' +1 )tr m / n (:r)) = and (b,x) ^ A F . Hence, 
Gp is transversal to V . Using the subgroup V we construct an AB function F' given in 
the following theorem. 

Theorem 4 The function F' : F 2 m — > F 2 m ; where m is odd and divisible by n, m ^ n and 
gcd(m,i) = I, 

F'(x) = x 2l+1 + tr m/n (x 2l+1 ) + x 2 'tr m/n (x) + x tr m/n (x) 21 

+ [tr m /n{x) T+1 + tr m/n (x 2l+1 ) + tr m/n (x)]^TT(x 21 + tr m/n (x) 21 + 1) 
+ [tr m/n (x) 2 ' +1 + tr m/n {x T+1 ) + tr m/n (x)]^TT(a; + tr m/n (x)), 
is an AB function which is EA-inequivalent to any power function. 



15 



Proof. Let m be odd and divisible by n. Obviously, the linear function 

C(x,y) = (Lx,L 2 ){x,y) = (x + tr m/n (x) + tr m/n (y),y + tr m / n (x)) 
is a permutation on F| m and 

C~ x (x,y) = (x + tr m / n (y),y + tr m / n {x) +tr m/n (y)). 

We have 

Fi(x) = x + tr m/n (x) + tr m/n (x 28+1 ), 
F 2 (x) =x T+l +tr m/n {x). 

By Proposition^ the function F\ is a permutation since £ _1 (V) = V and Gp is transversal 
to V. We need the inverse of the function F\ to construct F' = F 2 o F^ 1 . 
For any fixed element x G F 2 ™ we have 

y = x + tr m/n (x) + tr m/n (x T+l ) = x + u, 

for some u G F 2 n, and, therefore, a; = y + it. Then 

y = (y + u) + tr m/n (y + u) + tr m/n ((y + u) T+l ) 

which yields 

u 2 ' +1 + u T tr m/n {y) + u{tr m/n (y)) T + tr m/n (y T+l ) + tr m/n (y) = 0. 
If tr m / n (y) 7^ then we denote t> = u/tr m / n (y) and we get 

tr m /n(y 2 ' +1 ) +tr m/n (y) 



(4) 



Om/ntj/)) 2 ' 



+ 1 



0. 



Since v 2l+l + v 2 ' + v = (v + l) 2l+1 + 1 then 



v + 1 



tr m /n(y + ) +tr m/n (y) 
{tr m / n {y)) 2i+l 



l 

2 ! +l 



Replacing t> by u/tr m / n (y) we have 

« = [(^m/n(Z/)) 2i+1 + ^m/n(Z/ 21+1 ) + frtn/nG/)] 5 ** 1 + tr m/n (y). 

If tr m / n (y) = then from the equality (HJ) we get w = [tr m / n (y 2!+1 )] 2i +! and we observe 

that u equals again [{tr m/n {y)) T+1 + tr m/n (y 2 ' +1 ) + tr m / n (y)]^ +tr m/n (y). Thus, in all 
cases, we have 

FiHv) = y + u = y+ \{tr m/n (y)) T+l + tr m/n (y 2l+1 ) + tr m/n (y)}^ + tr m/n (y) 
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and 

F\x) = F 2 o Fi\x) = [x + [(tr rn/n (x)f +1 + tr m/n (x 2 ' +1 ) + tr m/n (x)}^ + tr m/n (x)f +1 
+ tr m/n [x + [{tr m/n (x)) 2l+l + tr m/n (x 2t+l ) + tr m/n (x)]^ + tr m/n (x)} 

x -\- tv m j n {x ) -|- tv m i n {x) + x tr m ^ n (x) -|- 3?(tr m / n (x)) 
+ [(tr m /n(x)f +1 + tr m/n (a; 2l+1 ) + tr m/n (x)}^ (x r + (tr m/n (:r)) 21 + 1) 
+ [(^ m/n (x)) 2!+1 + tr m/n (x 2l+l ) + tr m/n (x)]^l(x + tr m/n (x)). 

We show below that the function F 1 has the algebraic degree n + 2. It means that the 
number of functions CCZ-equivalent to a Gold AB function and EA-inequivalent to it is 
not smaller than the number of divisors of m. 

The inverse of x 2l+1 on F 2 « is x d , where 

71-1 

2 

2ik 



k=0 



and x d has the algebraic degree [26J. Obviously, ((tr m / n (x)) 2l+1 + tr m / n (x 2l+v ) + 
tr m / n (x)) d has the algebraic degree n + 1 if and only if ((tr m / n (a;)) 2I+1 + tr m / n (x 2l+1 )) d has 
this algebraic degree. 

i 

We assume that m ^ n and n ^ 1 since when m = n we get F'{x) = x 2 ^ 1 + x and 
Theorem Q gives the case n = 1. 
We have 



tr m / n (x) = ^2 



i 

x 2 

k=0 



and 



n n 

2 i +l\2 kn 



{tr m/n (x)f +1 + tr m/n (x 21+1 ) = ^ ***** + XA X 

k=0 k=0 k=Q 

m rn -y rn_ j 

n n n 



Note that we have 



x 



k,j=0 k=0 k,j=0 

k+j 



m ^ rn ^ 

n n 

[(tr m/n (x)) 21+1 + tr m/n (x 2I+1 )] 22l+1 = * 2kn+2Jn+l E x 2fen+2l+2J " +3! 

k,j=0 k,j=0 

k+i k^j 

m 

n 

^kn _^_<23 7lJ r'i _|_2 sn ~l~2i j otn+3i 



E 

k,j,s,t=0 
kj^j,s^t 



X 
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Similarly, we have 



((tr m/n (x)r +1 +tr m/n (x^)r= Yl x^ 2kan+S \ (5) 

(ko,...,k n )eI 

where I = {(/„, ...,/„): < l t < f - 1, Z 2t ^ / 2m }. 

The equality k s n + si = k t n + is possible for < s < t < n only for s = and t = n. 
Indeed, if k s n + si = k t n + ti then (k s — k t )n = (t — s)i. Since gcd(n, i) = 1 and < t, s < n 
then t = n, s = and k s — kt = i. 

For simplicity we consider now the equality (JHJ) in the case i — 1. In the sum ^™ =0 2 fcsn_M 
the largest possible item is 2(~~ 1 ) n+n = 2 m . Therefore, when fc n 7^ — — 1 the sum is smaller 
than 2 m — 1. Besides, all items in the sum are different modulo 2 m — 1 except the case when 
k = and k n = — — 1 and in the cases where ko — k n + 1. Therefore, when k Q = k n = 1 
the number ^g =0 2 fcsn+s has the weight n+ 1. On the other hand, when k Q = k n = 1 and 
fci = A; n _i = the term 

V^n nk s n + s 

does not vanish in (jHJ). Indeed, if 

n n 

£ 2 fesn+s = 2tpn+P mod ( 2m - X ) 

s=0 p=0 

then we have only two possibilities: 

1) for any s there exists p such that k s n+s = t p n+p (and vice versa). Then (k s —t p )n = p—s 
and since < s, p < n then ko = t n + 1, t = k n + 1 and k s = t s for s ^ 0,n. If k = k n = 1 
then t n = 0, t = 2. But in our case k = k n = 1, t% = k± = 0, t n _i = £; n _i = and, 
therefore, t„ 7^ since 7^ t n . 

2) if t n = — — 1 then fc must be equal to or fc„, = ^ - 1, but k = k n = 1. 

Thus, when k = k n = 1 and fci = fc n _i = (for permissible 1 < s < n — 1) the term 

v^n r)k s n + s 

has the algebraic degree n + 1 and it does not vanish in @ . 
If n > 5 we can also take k^ — 1, — k± — and then we get 

2 k s n+s = 2 n + 2 + 2 n+2 + 2 3 + 2 4 + ... + 2 2n . (6) 

s=0 

We have 

(0^ m/n (x)) 3 + tr m/n (x 3 )) d (x 2 + tr m/n (x) 2 ) + ((tr m/ )) 2d {x + tr m/n {x)) 

(ko,...,k n )£l l<k<m/n—l (ko,—,k n )£l l<j<m/n—l 
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= x z nk+1 +T l s=o' 2ksn+s + x 2nJ+E "=o 2fcsn+s+1 (7) 

(feo,...,feTi)G/ (k ,...,k„)el 
l<k<m/n—l 1 < j <m /n — 1 

We consider the item with the exponent 

2 n + 2 + 2 n+2 + 2 3 + 2 4 + ... + 2 2n + 2 nk+1 (8) 

from the first sum in © . It is easy to see that 2 n + 2 + 2 n+2 + 2 3 + 2 4 + . . . + 2 2n + 2 nk+1 < 2 m 
since k < m/n — 1. In this sum nk + 1 = k s n + s only if s = 1. But then = k\ = which 
is in contradiction with 1 < k. Thus, the number given by this sum has the weight n + 2. 
The item with the exponent (JHJ) does not vanish. Indeed, if there is another item in the 
first sum of (J7J) with this exponent then 



2 n + 2 + 2 n+2 + 2 3 + 2 4 + ... + 2 2n + 2 nfe+1 = 2 nj+1 + ^2 



ks-n+s 





If k = j then (JBJ) is equal to another sum Y^ =0 2 kan+s and we already showed that it is 
impossible. Ilk ^ j then k\ = k and j = while 1 < j. 

Assume there exists an item in the second sum of (JZJ with the exponent (JHJ) then 

n 

2 n + 2 + 2 n+2 + 2 3 + 2 4 + ... + 2 2n + 2 nk+1 = 2 nj + ^ 2 ksn+s+1 

for some j, 1 < j < m/n — 1 and (k , k n ) G /. We have 3 = k s n + s + 1 mod m for 
some s, < s < n. Then fc s n = 2 — s or k s n = m — (s — 2) and this is possible only if 
k 2 = or k 2 = m/n, but since < k s < m/n — 1, then 3 = k s n + s + 1 mod m only if 
k 2 = 0. The same arguments show that 4 = k s n + s + 1 mod m only if k^ = and that is 
in contradiction with the condition k 2 t ^ k 2t+ \. Therefore the item with the exponent (JHJ) 
does not vanish in (J7J) and then it does not vanish in the sum presenting the function F' . 
This completes the proof that F' has the algebraic degree n + 2. 

The algebraic degree of the function tr(F'(x)) is not greater than n + 1 since 

tr(F'(x)) = tr(x 2l+1 + tr m/n (x T+1 ) + tr m/n (x) + x 2 \r m/n {x) + x{tr m/n (x)) T ) 

+ tr n ([(tr m / n (x)f +1 + tr m/n (x 2l+l ) + tr m/n (x)}^tr m/n (x 21 + {tr m/n (x)) 21 + 1)) 

+ tr n ([(tr m/n (x)) 2 ' +1 + tr m/n (x 2 ' +1 ) + tr m/n (x)}^tr m/n (x + tr m/n (x))) 

= tr(x) +tr(x 2l tr m/n (x)) + tr(x(tr m/n (x)) T ) 

+ tri[{tr m/n (x)) T+l + tr m/n (x T+1 ) + tr m/n {x)}^). 

On the other hand d°(tr(F'(x))) is not or 1. Indeed, for any x G we have 
tr(F'(x)) = tr(x) + 2tr(x 2 ' +1 ) + tr([2x T+1 + x]^) = tr(x) + tr(x^). 
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The function tr (x 2Z + 1 ) has the algebraic degree (n+l)/2. Indeed, d°(tr(x 2t + 1 )) G {0,d°(x 2l + 1 )} 

i i i 

and since x 2 ^ 1 is a permutation then tr(x 2i + 1 ) is not a constant and d°(tr(x 2i + 1 )) = 
i 

^(x 2 ^ 1 ) = (n+ l)/2. Hence, tr(F'(x) is not linear on F 2 ™ and then it cannot be linear on 
Thus, the function F' is EA-inequivalent to any power function by Proposition 0] □ 



6 Conclusion 

We have shown that there exist APN and AB functions which are EA-inequivalent to power 
functions, and therefore, which are new, up to EA-equivalence. But these functions are 
CCZ-equivalent to the Gold functions. We leave two open problems: 

- finding classes of functions CCZ-equivalent to other known APN or AB functions, which 
would be EA-inequivalent to all known APN and AB functions (or even, inequivalent to 
power functions); 

- finding classes of APN or AB functions which would be CCZ-inequivalent to all known 
APN and AB functions (or even, CCZ-inequivalent to power functions). 
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